purecrypter | 819d25cd270e2948e396ab241b33ce326fdc88d4744ce57b00c678aaa13c07a3

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
12-07-2024 17:13

Target

3e30bda754f5aceba86a09d2297bef9d_JaffaCakes118.exe
Size

18KB
MD5

3e30bda754f5aceba86a09d2297bef9d
SHA1

b615305986a9939be856f0e18b73aa57289ed424
SHA256

819d25cd270e2948e396ab241b33ce326fdc88d4744ce57b00c678aaa13c07a3
SHA512

16b8d7671811a5b96b901cf36e535fd0e5bff4e09f8acc6cd3354b0352533dea7341d41dbfcf84f311398afe8d93202332a6768b62bcee661681f06d4af01e86
SSDEEP

384:1/YtWX3VsI0ZNvmxKDQCkEKDVbJEp5KDGPGAblW/ItW:1Sil9mPGk

Score

10^/10

Family

purecrypter

https://store2.gofile.io/download/6cfa5f96-0a27-494c-acab-e04bc98e61ae/Mdsljadlksosujin.dll

PureCrypter
PureCrypter is a .NET malware loader first seen in early 2021.
loader downloader purecrypter
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3672 736 WerFault.exe 3e30bda754f5aceba86a09d2297bef9d_JaffaCakes118.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

3e30bda754f5aceba86a09d2297bef9d_JaffaCakes118.exe

description pid process

Token: SeDebugPrivilege 736 3e30bda754f5aceba86a09d2297bef9d_JaffaCakes118.exe

pid	pid_target	process	target process
3672	736	WerFault.exe	3e30bda754f5aceba86a09d2297bef9d_JaffaCakes118.exe

description	pid	process
Token: SeDebugPrivilege	736	3e30bda754f5aceba86a09d2297bef9d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\3e30bda754f5aceba86a09d2297bef9d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3e30bda754f5aceba86a09d2297bef9d_JaffaCakes118.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:736
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 736 -s 1776
  2⤵
  - Program crash
  PID:3672

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 736 -ip 736
1⤵
PID:4920

memory/736-0-0x0000000074A3E000-0x0000000074A3F000-memory.dmp

Filesize
4KB

Download
memory/736-1-0x0000000000780000-0x000000000078A000-memory.dmp

Filesize
40KB

Download
memory/736-2-0x0000000074A30000-0x00000000751E0000-memory.dmp

Filesize
7.7MB

Download
memory/736-3-0x0000000074A30000-0x00000000751E0000-memory.dmp

Filesize
7.7MB

Download